Looking for a procurve expert

[dastrix]

Hey guys

 

I have inherited a procurve network and have had a problem this week that has caused me to wipe out the configuration, and start again now we have approx 10 vlans that are used but I'm trying to simplify the setup for ease of management.

 

Some questions I have are do I need every vlan on every switch? Should I have an admin vlan for the techies.

 

If you want to get in contact I can give more details.

 

Das

[Techie-v2]

Well it depends on your network of course but 10 does sound a bit much. Ive been looking a setting vlans up on ours and have deduced on 1 management, 1 for main network and 1 each for different wireless lans (student byod, staff byod etc)

[Tallwood_6]

It depends on what each VLAN is for i.e. If some of the vlans are designed for stations in geographical locations then obviously you won't need all of these on each edge switch. That said it certainly does no harm to add them all.

[burgemaster]

We currently have zero vlans.

We are shortly having WAN installed site wide. Would it be a good time now to learn and set this up ourselves? Or leave it to the install guys? All procurves too. Will be Interested in how you get on!

[dastrix]

We have 10 different vlans for workstations ie each location

 

But they are all pushed out from the core switch have been told this is a bad idea?

 

Voice vlan

 

Printers vlan

 

Server vlan

 

Then 3 different wifi vlans and lots of unused

 

 

Sent from my iPad using EduGeek

[Tallwood_6]

I'm not sure what you mean by pushed out by the core switch, but 10 vlans for workstations by location seems a bit much unless your running hundreds of workstations from each location?

[dastrix]

I guess I mean they are dynamic vlans was told this is a bad idea thoughts?

[adamf]

Depends on how your network is setup, size etc... I wouldn't say 10 is too many if the number of clients, setup warrants it.

 

I have 19 VLANs on my Core Switch... (HP 5406zl), I'm working from a /20 address range (4096 addresses), firstly split into 2x /21 ranges, one of those /21 is solely for wireless clients, the other /21 is subnetted further, broken down (as logically as possible) into areas of the school.

 

I don't necessarily have all VLANs on every edge switch, only those edge switches that need to serve multiple VLANs for whatever reason.

[Roberto]

This isn't a x is the right number of vlans type of thing. It very much depends on your infrastructure, design philosophy, and goals. We have quite a few vlans defined (and they're defined on each switch too) but then we're a college with a large number of workstations, a complex set of requirements and 44 managed switches to look after, plus the usual assortment of extra dumb ones tucked here and there.

 

Do you require separation of a group of network devices for security reasons? Then (while a VLAN isn't exactly a hard security boundary) they probably need to be in their own vlan. Do you need to route traffic around a large network? Do you need to provide alternate routes for site interlinks? Do you need to keep Ethernet broadcast domains to a manageable size? These are all questions that a VLAN might be at least part of the answer to.

 

Have you considered getting Procurve Manager Plus? This makes managing a number of HP switches much easier.

[dastrix]

Yeah we did look at it but in the end got device expert from manage engine

[howartp]

We have 7 VLANs for PCs per location, plus say another 6 for other seperation/security purposes. Only have each VLAN presented on the switches where they are needed.

 

Been trying HP PCM over 12 months but it's crashed my network every time without fail, so definitely interested in Device Expert - not come across that.

[dastrix]

Here is my problem, HP support is as near as useless.

 

I have scrubbed the problem switch and built a complete new config.

 

4 VLANS

 

Default

Voice

1

2

 

port 48 is connected to the core via fibre and the port is set to untagged if i set it to tagged for all the vlans i lose connectivity to it from admin pc's

 

should ports that need voice and vlan 1 have these both tagged? or do i just set it to tagged vlan 1

 

Thanks in advance.

[localzuk]

The VLANs need to match at both ends of a link. If you have a fibre link tagged with all VLANs at one end, they need to be tagged with all VLANs at the other end too.

 

If you have the default VLAN untagged and the rest tagged, it has to be the same both ends.

[Tallwood_6]

Uplinks carry tagged traffic for all the vlans you wish to be available at the connected switch (although you can probably leave the default vlan untagged), the ports connected to client workstations will need to be untagged for the correct vlan.

VOIP phones can usually handle tagged traffic as in some instances you will have a client PC running off the same connection.

Edited February 28, 2014 by Tallwood_6

[Oaktech]

We have 6 static vlans and these are only on the switches they are required at.

 

Vlan1 is our default broadcast domain

Vlan2 is the incoming tunnel between our primary school and the core switch for routing

Vlan3 is our test domain

Vlan4 is our Printers Vlan

Vlan5 is our restricted guest wireless

Vlan6 is our unrestricted guest wireless.

 

All switches have Vlan 1, 4,5 and 6 on them as the utility is required on all of them.

 

Only the incoming switch, and the intervening switches between it and the core have vlan2 (2 switches), along with all intervening switches between our office and the core (also 2 switches) so we can plug into their network in our office.

 

Only the core and intervening switches (2 switches) between there and our office have Vlan 3.

 

This is to do with the tagging on the interconnecting links/trunks.

[dastrix]

1 last question then, having problems with wol across vlans what do I need to set?

 

Ip forward protocol is it?

[howartp]

Unfortunately I've not done routing commands on Procurve as our core switch is Cisco.

 

On Cisco it's an Access-List rule such as:

 

access-list 101 permit udp 7 all

 

(That's off top of my head)

 

I'm sure someone else will have done Procurve version.

[Tallwood_6]

Enable on the switch:

 

ip directed-broadcast

ip udp-bcast-forward

 

And then on the VLAN the wake on lan broadcast is originating from, i.e. Server VLAN specify the broadcast address the stations are on.

 

ip forward-protocol udp 10.0.5.255 7

[dastrix]

So the second spec do I just do on the core switch or for each vlan on the switch nearest the client too?

[Tallwood_6]

You configure this just on the core switch. You may need to double check the udp port your wol is using. I think port 7 or 9 most common but it could use another port I.e cc4 remote start uses udp 10000

[dastrix]

We use port 9,

 

Ok so have added this to the core and its not working

[Tallwood_6]

Post your running config

[dastrix]

I'll pm it to you

[dastrix]

Running configuration:

 

; hpStack Configuration Editor; Created on release #KA.15.10.0022

; Ver #05:08.00.63.1f.ef:9e

 

stacking

member 1 type "J9584A" mac-address 082e5f-690d00

member 2 type "J9584A" mac-address 082e5f-69bc40

member 3 type "J9576A" mac-address b4b52f-a8d1c0

exit

hostname "SR1-3800-STACK"

mirror 1 port 3/10

no dhcp-relay hop-count-increment

trunk 3/33 trk5 trunk

trunk 3/37-3/40 trk10 lacp

trunk 3/41-3/44 trk11 lacp

gvrp

logging 10.0.30.35

logging facility local3

timesync sntp

sntp unicast

sntp server priority 1 10.0.0.25

telnet-server listen data

web-management listen data

ip access-list extended "dmz"

exit

ip default-gateway 10.0.0.25

ip dns server-address priority 1 10.0.30.1

ip dns server-address priority 2 10.0.30.2

ip ssh listen data

ip route 0.0.0.0 0.0.0.0 10.0.0.25

ip route 0.0.0.0 0.0.0.0 192.168.120.1

ip route 10.1.0.0 255.255.255.0 10.0.30.11

ip route 10.2.0.0 255.255.255.0 10.0.30.11

ip route 10.5.40.0 255.255.252.0 vlan 150

ip route 192.168.0.0 255.255.255.0 10.0.0.25

ip route 192.168.0.0 255.255.255.0 10.0.30.11

ip routing

ip udp-bcast-forward

ip multicast-routing

interface 1/1

lacp active

name "b4-2910-14"

exit

 

Removed the interface config for space

 

snmp-server community "spanky" unrestricted

snmp-server community "public" operator

snmp-server host 10.0.30.35 community "public" trap-level not-info

snmp-server listen data

snmp-server contact "Chris" location "ServerRoom1"

oobm

disable

ip address dhcp-bootp

member 1

ip address dhcp-bootp

exit

member 2

ip address dhcp-bootp

exit

member 3

ip address dhcp-bootp

exit

exit

router pim

enable

exit

vlan 1

name "DEFAULT_VLAN"

no untagged 3/11-3/12,3/17

untagged 1/1-1/26,2/1-2/26,3/1-3/10,3/13-3/16,3/18-3/32,3/34-3/36,3/45-3/52,Trk5,Trk10-Trk11

ip address 10.0.0.1 255.255.0.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip forward-protocol udp 10.0.30.11 ntp

ip forward-protocol udp 10.0.30.255 9

ip forward-protocol udp 10.5.31.255 2050

ip forward-protocol udp 10.5.39.255 2050

ip forward-protocol udp 10.5.3.255 2050

ip forward-protocol udp 10.5.7.255 2050

ip forward-protocol udp 10.5.11.255 2050

ip forward-protocol udp 10.5.15.255 2050

ip forward-protocol udp 10.5.19.255 2050

ip forward-protocol udp 10.5.23.255 2050

ip forward-protocol udp 10.5.27.255 2050

ip forward-protocol udp 10.5.35.255 2050

ip igmp

ip igmp forward 1/1-1/26,2/1-2/26,3/1-3/4,3/8-3/24,3/29-3/32,3/34,3/45-3/52,Trk5

ip pim-dense

ip-addr any

exit

exit

vlan 2

name "mitel"

ip address 10.5.88.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

voice

exit

vlan 10

name "VLAN10"

no ip address

exit

vlan 50

name "mirror_vlan"

no ip address

exit

vlan 100

name "admin"

tagged 1/1-1/26,2/1-2/26,3/1-3/4,3/8-3/24,3/29-3/32,3/34,3/45-3/52,Trk5

ip address 10.5.48.1 255.255.252.0

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 101

name "wksblock1"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.1.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip forward-protocol udp 10.0.30.41 9

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 102

name "wksblock2"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.4.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip forward-protocol udp 10.0.16.1 3000

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 103

name "wksblock3"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.8.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 104

name "wksblock4"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.12.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 105

name "wksblock5"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.16.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 106

name "wksblock6"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.20.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 107

name "wksblock7"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.24.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 108

name "wksblock8"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.28.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 109

name "wksblock9"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.32.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 110

name "wksblock10"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.36.1 255.255.252.0

ip proxy-arp

ip directed-broadcast

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 150

name "workstations"

tagged 1/1-1/26,2/1-2/26,3/15

ip address 10.5.40.1 255.255.252.0

ip bootp-gateway 10.5.40.1

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.30.1

ip helper-address 10.0.43.11

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 200

name "voip"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.44.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 250

name "office"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.76.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 300

name "wifiadmin"

untagged 3/11-3/12

tagged 1/1-1/26,2/1-2/26

ip address 10.5.84.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.43.11

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 310

name "wifiguest"

tagged 1/1-1/26,2/1-2/26,3/11-3/12

ip address 10.5.100.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.43.11

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 320

name "wifistudent"

tagged 1/1-1/26,2/1-2/26,3/11-3/12

ip address 10.5.104.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.43.11

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 330

name "wifistaff"

tagged 1/1-1/26,2/1-2/26,3/11-3/12

ip address 10.5.108.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.43.9

ip helper-address 10.0.43.11

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 350

name "BYOD-Staff"

tagged 1/1-1/26,2/1-2/26,3/11-3/12

no ip address

ip helper-address 10.0.30.1

ip helper-address 10.0.30.2

exit

vlan 500

name "server"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.52.1 255.255.252.0

ip proxy-arp

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

ip igmp

ip pim-dense

ip-addr any

exit

exit

vlan 600

name "dmz"

tagged 1/1-1/9,1/11-1/26,2/1-2/9,2/11-2/26,3/21,3/23

ip address 192.168.30.220 255.255.255.0

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 700

name "slg"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.56.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 800

name "backup"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.60.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 900

name "cluster"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.64.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 1000

name "unknown"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.68.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 1100

name "tun"

tagged 1/1-1/26,2/1-2/26

ip address 10.5.72.1 255.255.252.0

ip helper-address 10.0.43.9

ip helper-address 10.0.30.160

ip helper-address 10.0.30.161

ip helper-address 10.0.43.11

ip forward-protocol udp 10.0.30.11 ntp

exit

vlan 1200

name "gateway"

ip address 10.5.80.2 255.255.252.0

ip address 192.168.120.2 255.255.255.0

exit

vlan 2000

name "foo"

no ip address

exit

spanning-tree

spanning-tree Trk5 priority 4

spanning-tree Trk10 priority 4

spanning-tree Trk11 priority 4

no tftp server

tftp server listen data

no autorun

no dhcp config-file-update

no dhcp image-file-update

trunk-load-balance L4-based

password manager

password operator

[Tallwood_6]

Blimey a bit much to properly scan through but what have you go on what I.e are the servers on the default VLAN now not the one labeled servers vlan 500?

You have what looks like the broadcast address of the range you have the servers on not the stations I.e you need

ip forward-protocol udp 10.5.31.255 9

ip forward-protocol udp 10.5.39.255 9

ip forward-protocol udp 10.5.3.255 9

Etc